Open-source Software Erase The Hard Drives Of Computers In Russia And Belarus

A maintainer has been criticized for creating a poisonous open-source npm program that can erase the hard drives of computers located in Russia and Belarus.

The open-code npm source-code package called peacenotwar was written by Brandon Nozaki Miller, JavaScript’s package manager maintainer RIAEvangelist.

The package has a 9.8 severity rating. It is tracked as CVE-2022-23812. It contains malicious code that targets users with IP located in Russia or Belarus and overwrites their files with a heart emoji.

Miller initially wrote the code to protest Russia’s invasion of Ukraine. However, other capabilities were added and soon, the code started destroying computers’ file systems.

Liran Tal, the Snyk researcher who uncovered the problem explain that such action could result in the maintainer not being trusted again.

“Even if the deliberate and dangerous act of maintainer RIAEvangelist will be perceived by some as a legitimate act of protest, how does that reflect on the maintainer’s future reputation and stake in the developer community?” Tal said.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web